All Apps and Add-ons

Rising column not working with Netezza connection

patouellet
Path Finder

Hi,

First I just want to say we are using DB Connect and DB Inputs with Rising columns extensively with DB2, Oracle and SQL Server database types - all without issues.

But recently we've been trying to setup a DB Input with Netezza database and the rising column is not working - not doing what it's supposed to be doing. I have a DB Input setup to run every 5 minutes and it pulls the same record everytime. Looking at the TIME column I am using as a rising column, and the checkpoint value Splunk DBConnects uses, it looks like the checkpoint value isn't precise enough to make the where statement work as intended.

The query is:

 SELECT * 
    FROM "HISTDBV3"."HISTUSR"."$hist_failed_authentication_3"
    WHERE TIME > ?
    ORDER BY TIME ASC

The value of the TIME column is:

2020-03-10 19:34:04.884102

The checkpoint value is (according to the Edit Input interface):

3/10/2020 19:34:04.884

So of course if with statement "WHERE TIME > ?" then it is always true (19:34:04.884102 > 19:34:04.884).

Looks like a bug to me. Anyone experienced this?

Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...